OneTap trust center
Draft for legal review. Not yet published. This page describes what OneTap is built to do. Counsel and Oltin's security lead must review it, and complete every part in square brackets, before OneTap goes live.
Documents
- Data Processing Agreement, version 2026-10: every company accepts it when it signs up.
- Compliance pack, version 2026-10: the answers a security or procurement review usually asks for, with a template for your own data protection impact assessment. Open it and print it, or save it as a PDF.
- Accessibility statement: the standard OneTap is built to, how it is checked, and how to tell us about a barrier.
- Privacy policy for the OneTap app: what the app does with a person's data, for anyone reading before they install it.
- Support: how to get help with OneTap.
Your role and ours
Your company decides why and how its employees' attendance is recorded: under India's Digital Personal Data Protection Act, 2023, it is the Data Fiduciary. Oltin processes the data on your behalf, as your Data Processor, only to provide OneTap.
Where your data is kept
OneTap stores and processes data in the European Union, in Google Cloud's Belgium region. It leaves the European Union only for the phone checks Apple and Google run, and in transit across the network edge.
Sub-processors
| Sub-processor | What it does | Where |
|---|---|---|
| Google Cloud | Hosting and the database | Belgium, European Union |
| Cloudflare | Network edge, DNS and protection from attacks | Edge locations; data at rest stays in the European Union |
| Zoho (ZeptoMail) | Sending sign-in codes, invites and notices by email | Zoho's EU data centre |
| Apple and Google | Checking that a phone and the OneTap app are genuine | Their own services |
We give every company at least 30 days' notice before we add or replace a sub-processor, and a company may object by writing to us at the address below. This list was last changed in October 2026.
What OneTap collects, and what it never does
- Check-in and check-out times as the server records them, the office matched, and which checks passed.
- When a person checks in or out, the office Wi-Fi router's hardware ID and name, and the public address of the request. While the Today screen is open, the app also sends these and, if allowed, the phone's position to show whether the checks would pass, and OneTap doesn't store them. At an office with an area set, how far the phone was from the office and how accurate that reading was, never its position.
- No location trails and no stored coordinates of people. If a person allows location all the time, the phone says only when it leaves the office's area after a check-in.
- No biometrics. Face ID and fingerprint never leave the phone: OneTap receives only a signature the phone makes after it unlocks its key.
- We don't sell the data, use it for advertising, or profile your people.
Security
- Encryption in transit (TLS 1.2 or newer) and at rest.
- Each company's data is kept apart in the database by row-level security, and tested on every change.
- Every check-in is decided on the server. Phones are linked with keys held in their secure hardware, and checked with Apple App Attest or Google Play Integrity.
- Attendance records, edits and the audit trail are chained by hashes, so a change made outside OneTap can be detected. Admins can run the check themselves.
- Oltin's own staff reach the operator console only from allowed networks, through single sign-on and a code from an authenticator app, and every action they take is in a platform audit. To help a company, a named member of staff can open its OneTap Admin for two hours at most, with the reason recorded, as far as its owner allows: to see it only (where a new company starts), to see it and make the changes an admin can, or not at all. They never act as the owner, and the company's audit trail shows when they came in and what they did.
- Controls aligned with ISO/IEC 27001 run from the start, and the application is built to OWASP ASVS level 2.
Certifications and testing
OneTap holds no certification yet. [Planned certification and timeline.] Before launch, an internal security review read the code, and an internal penetration test attacked the running services; both are complete and what they found is fixed. [Independent penetration test and date.] A summary of each assessment is added to the compliance pack.
Personal data breaches
We tell your company within 24 hours of becoming aware of a personal data breach, so you can inform the Data Protection Board of India and your people within 72 hours. Where the CERT-In directions require it, we report the incident to CERT-In within 6 hours.
Your people's rights
Employees can ask your company for a copy of their data, or for a correction, from the app. Your admins see each request with its due date, and your company names a grievance officer whom employees can reach in the app.
Keeping and deleting data
Statutory attendance records are kept for at least five years, as the Labour Codes require, and six for a company with an office in Uttar Pradesh, as its rules require. When your company leaves OneTap, it can download all of its data first. We then delete it and issue a certificate of deletion, keeping only the records the law requires until their period ends.
Availability
OneTap is built for 99.9% monthly uptime for check-ins and OneTap Admin. [Status page address, once it exists.]
Accessibility
OneTap Admin is built to WCAG 2.1 AA and checked automatically on every change; the app supports screen readers and larger text. The accessibility statement says how to tell us about a barrier.
Contact
To report a security issue, write to security@oltin.ai. For anything about privacy or this page, write to support@oltin.ai. By post: Oltin, 431 Fen Street, Brooklands, Milton Keynes, MK10 7PE.